The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade shadow | May 7, 2019 | Aug 4, 2017 |
| Debian | — | Upgrade shadow | Mar 19, 2021 | Aug 4, 2017 |
| Gentoo Linux | — | Upgrade sys-apps/shadow. | Oct 30, 2017 | Aug 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade shadow-utils | Dec 4, 2019 | Aug 4, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade shadow-utils | Jun 28, 2018 | Aug 4, 2017 |
| Suse | — | Upgrade shadow | Nov 8, 2017 | Aug 4, 2017 |
| Ubuntu | — | Upgrade login (Ubuntu Pro)Upgrade passwdUpgrade passwd (Ubuntu Pro)Upgrade uidmapUpgrade loginUpgrade uidmap (Ubuntu Pro) | Jan 28, 2022 | Aug 4, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 4, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub